fix(release): own the backend data dir for the non-root container user (phase 4 slice 2, REQ-83)

.ciagent/release/deploy.sh

@@ -216,6 +216,12 @@ SSH "
     docker stop '$CONTAINER_BACKEND_PREV' >/dev/null 2>&1 || true
   fi
   mkdir -p '$BACKEND_DATA_DIR'
+  # The container runs as the image's non-root user and a bind mount
+  # SHADOWS the image's own (correctly owned) /var/lib/researchx, so a
+  # root-owned host dir makes every write to the data root (users.json,
+  # sessions.json, keys/) fail with EACCES while /healthz still answers
+  # 200. Take the owner from the image itself.
+  chown -R \$(docker run --rm --entrypoint stat '$IMAGE_BACKEND:$VERSION' -c '%u:%g' /var/lib/researchx) '$BACKEND_DATA_DIR'
   docker run -d --name '$CONTAINER_BACKEND' --restart unless-stopped \
     -p '$HOST_PORT_BACKEND:8000' \
     -v '$BACKEND_DATA_DIR:$BACKEND_DATA_DIR' \
@@ -247,6 +253,13 @@ while [ "$i" -lt "$HEALTH_RETRIES" ]; do
 done
 [ "$i" -lt "$HEALTH_RETRIES" ] || die "backend container did not become healthy within $((HEALTH_RETRIES * HEALTH_INTERVAL))s" 5
 
+# The health check above is a GET: it proves the app answers, not that it
+# can persist. Probe the write path the auth/key stores use, so a
+# mis-owned data root fails the deploy instead of the first signup.
+log "checking the backend can write its data root"
+SSH "docker exec '$CONTAINER_BACKEND' sh -c 'touch \"\$RESEARCHX_DATA_DIR/.write-probe\" && rm -f \"\$RESEARCHX_DATA_DIR/.write-probe\"'" \
+  || die "backend data root is not writable by the container user" 5
+
 log "health-checking frontend http://$DEPLOY_HOST:$HOST_PORT$HEALTH_PATH (retries: $HEALTH_RETRIES)"
 i=0
 while [ "$i" -lt "$HEALTH_RETRIES" ]; do